Vulnerability Reportsonatype/nexus3:3.87.1-alpine

This image poses a critical security risk and must not be used in production, especially as an internet-facing service. An attacker could exploit the Jetty HTTP/1.1 parser (CVE-2026-2332) to perform request smuggling, bypassing security controls and potentially splitting requests to backend handlers, while the Netty HTTP parsing flaw (CVE-2026-42584) could cause data confusion and integrity/availability loss. With 238 exposed vulnerabilities and 14 rated high severity (>=7.0), the attack surface is broad and includes remote, unauthenticated denial-of-service and potential smuggling vectors. The verified publisher and immutable digest do not offset these critical network-facing risks, so immediate remediation or an alternative image is required.